Respond with status 400 for invalid requests handled by spring security firewall

acceptance-test/src/acceptance-test/java/org/zalando/nakadi/webservice/InvalidRequestAT.java

@@ -0,0 +1,18 @@
+package org.zalando.nakadi.webservice;
+
+import org.apache.http.HttpStatus;
+import org.junit.Test;
+
+import static com.jayway.restassured.RestAssured.given;
+import static org.hamcrest.Matchers.notNullValue;
+
+public class InvalidRequestAT {
+    @Test(timeout = 10000)
+    public void whenRequestRejectedExceptionThrownThenResponseIs400() {
+        given()
+                .when()
+                .get("//")
+                .then()
+                .statusCode(HttpStatus.SC_BAD_REQUEST);
+    }
+}

app/src/main/java/org/zalando/nakadi/filters/RequestRejectedFilter.java

@@ -0,0 +1,30 @@
+package org.zalando.nakadi.filters;
+
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.web.firewall.RequestRejectedException;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.GenericFilterBean;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE)
+public class RequestRejectedFilter extends GenericFilterBean {
+
+    @Override
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
+        try {
+            chain.doFilter(req, res);
+        } catch (RequestRejectedException e) {
+            HttpServletResponse response = (HttpServletResponse) res;
+
+            response.sendError(HttpServletResponse.SC_BAD_REQUEST);
+        }
+    }
+}